What happens in Prisma Cloud after Training Model Threshold or Alert Disposition is changed?

When an administrator modifies the Training Model Threshold or the Alert Disposition for an anomaly policy in Prisma Cloud, the platform does not wait for a new learning cycle or only apply the change to future events. Instead, it immediately re-evaluates the existing learned behavioral model against the new settings. This re-evaluation process is retrospective, meaning Prisma Cloud will regenerate alerts based on the updated criteria. As a result, some existing alerts may be closed, and new alerts may be created from the same historical data that now violates the new threshold or disposition.

A. A new 30-day learning phase is not initiated. The system re-evaluates the currently established model against the new settings immediately.
B. A system reboot and deletion of historical alerts are drastic, disruptive actions not associated with tuning anomaly detection policies.
D. The change is not only for new alerts. Prisma Cloud applies the new settings retrospectively to regenerate the entire alert set for that policy.

1. Palo Alto Networks, "Prisma Cloud Administrator's Guide (Cloud Native)". In the section on "Anomalies," the sub-section "Tune Anomaly Policies" describes the process of adjusting thresholds. It states, "When you change the threshold, Prisma Cloud re-evaluates the model and regenerates alerts according to the new setting." This confirms the retrospective re-evaluation and regeneration of alerts.

2. Palo Alto Networks, "Prisma Cloud Administrator's Guide (Cloud Native)". The section on "Manage Alerts on the Prisma Cloud Console" explains how changing an alert's disposition affects its status. Applying this at the policy level (Alert Disposition) triggers a similar re-evaluation for all alerts governed by that policy.